Source publication time: November 6, 2026, at 18:15:33 (UTC+8). This article summarizes Odaily’s reporting and the statements it attributes to issuers, investigators and other participants.
Stablecoin issuers accounted for more than $2.3 billion of roughly $3 billion in assets frozen following a reported $6.3 billion theft from Binance, according to an Odaily article by Wenser. Tether and Circle provided the largest contributions by restricting transfers of USDT and USDC linked to the incident.
The distinction between freezing tokens and recovering funds is central to the response. An issuer’s freeze can prevent transfers without returning assets to Binance. Governance-controlled transfers and restrictions on lending markets represent different interventions, each with separate implications for recovery.
Tether and Circle accounted for the largest freezes
Odaily reported that Tether CEO Paolo Ardoino said the issuer had helped freeze more than 1.567 billion USDT potentially connected to the Binance theft.
Citing media tracking, the article said Tether initially froze approximately 1.18 billion USDT about 37 minutes after stolen tokens reached the attacker’s main Ethereum wallet. It then froze four additional attacker addresses within the following 17 minutes.
Those restrictions blocked outgoing USDT transfers; they did not mean Binance had recovered the corresponding funds.
Odaily put Circle’s contribution at approximately $823 million. It cited CEO Jeremy Allaire as publicly confirming that more than $800 million in USDC had been frozen and that Circle was coordinating with law enforcement. The report described Circle’s response as occurring three minutes after Tether’s.
According to the article, USDT and USDC represented about 94% of the stolen stablecoin assets, almost entirely on Ethereum and Tron.
Other stablecoin issuers also intervened
Binance co-founder and co-CEO He Yi said World Liberty Financial had frozen approximately $27 million in USD1 and $2 million worth of WLFI, according to Odaily.
WLFI co-founder Zach Witkoff publicly confirmed freeze measures and said the project would work with BitGo on the stolen WLFI and USD1. The article also reported assistance from Ripple in relation to RLUSD, as well as Paxos and First Digital, without providing individual freeze totals.
Investigators reported different recovery snapshots
Odaily said the FBI issued a notice on October 31 attributing the theft of more than $6 billion in virtual assets from Binance to North Korean actors associated with TraderTraitor.
The report described an address list containing more than 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address. The FBI, Secret Service and IRS Criminal Investigation called on infrastructure providers, DeFi services, analytics companies and virtual-asset service providers to block transactions connected to those addresses or their derivatives.
Blockchain analytics firms supplied tracing and attribution work, with figures reflecting different reporting snapshots:
- Elliptic estimated the theft at approximately $6.43 billion and verified about $2.85 billion as frozen or seized. It also published an expanding address blacklist and said its alerts had helped trigger freezes.
- Chainalysis reported approximately $2.8 billion frozen as of November 3 at about 11:30 a.m. ET. It said investigators shared leads with industry partners and linked the Binance proceeds to mixing activity involving funds stolen from Bitget the previous month.
- TRM Labs attributed the activity to TraderTraitor with high confidence, comparing the methods with the 2025 Bybit theft and an April 2026 KelpDAO incident.
- SlowMist founder Yu Xian said the attacker used EIP-7702 to steal hot-wallet tokens in batches and rehearsed for hours beforehand.
These figures should not be added together: they describe overlapping assessments of the same incident, not separate recoveries.
Network intervention differed from issuer freezes
Odaily reported that on October 30, Arbitrum’s Security Council moved approximately 8,426 ETH and 74.56 million ARB, valued together at about $30.5 million, from attacker addresses into an interim frozen address.
Further movement required action by the Security Council or an Arbitrum DAO governance vote. Officials said other users and applications were unaffected.
On Optimism, governance-side action moved approximately 44 million OP, worth about $5 million, out of attacker control. Binance had submitted governance proposals seeking the assets’ return, a process the article said could take weeks.
Aave restricted new activity rather than recovering borrowed ETH
According to the report, the attacker deposited approximately 60 million USDT into Ethereum’s Aave V3 and borrowed around 19,762 WETH, then worth about $44.6 million.
Aave subsequently froze hundreds of DAO-operated reserves across V3 and V4 as a precaution, stopping new deposits and borrowing while allowing withdrawals, repayments and liquidations. Founder Stani Kulechov said the contracts were unaffected and the position remained overcollateralized.
The intervention limited further use of the protocol; the previously borrowed ETH remained under attacker control.
Recovery remained unfinished
Odaily also described assistance or offers of support from Coinbase, Bybit and OKX. Coinbase CEO Brian Armstrong said his team was blocking transfers to compromised wallets. OKX CEO Star called for stronger shared security standards and coordinated incident response.
The report’s central caveat remains important: frozen assets are not necessarily returned assets. Further recovery depended on legal and governance processes, alongside efforts to intercept unfrozen proceeds moving through over-the-counter channels, mixers and exchange exits.